Authorization bypass through user-controlled key in Group Office - #VU164343
Published: November 10, 2026
Vulnerability identifier: #VU164343
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to overwrite and permanently destroy other users' stored file contents.
The vulnerability exists due to missing file authorization in the Group Office PDF Editor upload endpoint when resolving client-controlled fileId values, allowing overwrites before permission checks while failed backup writes are suppressed. A remote user can submit a multipart upload containing a victim's fileId and replacement content in the pdf field, or iterate sequential identifiers, to corrupt other users' files without recoverable versions.
Affected software
Group Office
Remediation
Install security update from vendor's website.
Group Office - addressed in versions 6.8.181, 26.0.58